xworm | eed75f0edf37bdd0d0a64ac8723672dbfe64288fb3845b89cc3596d0511f67d1

Analysis

max time kernel
300s
max time network
254s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
18-10-2024 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XWorm-5.6-main.zip
Size

24.8MB
MD5

98af17dc86622b292d58fbba45d51309
SHA1

44a7d9423ce00ddda8000f9d18e3fe5693b5776f
SHA256

eed75f0edf37bdd0d0a64ac8723672dbfe64288fb3845b89cc3596d0511f67d1
SHA512

b3b9c67e373bcba5bd039088953400a3296b374f29f5de00f56c0702da7f9eccf0c452586d486c17ab1ea5ab16240112fda8457ec258d2ba9735b17959db4b05
SSDEEP

786432:3vngbHGYI0DuXXEDgfI+tjIdubuu0SVww6vZqwffr:fgbHGY2hfI8yuxV7oswXr

Score

10^/10

xworm discovery rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

127.0.0.1:8888

Mutex

zqblZXNp30YPzbFF

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Extracted

Family

xworm

127.0.0.1:8888

Attributes

Install_directory
%AppData%
install_file
XClient.exe

Signatures

Detect Xworm Payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\315hsdo3\315hsdo3.0.vb	family_xworm
C:\Users\Admin\Downloads\XClient.exe	family_xworm
C:\Users\Admin\Downloads\XClient.exe	family_xworm
behavioral1/memory/1184-747-0x0000000000780000-0x000000000079C000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Executes dropped EXE 2 IoCs

Processes:

Xworm V5.6.exeXClient.exe

pid process

1908 Xworm V5.6.exe
1184 XClient.exe
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

43 ip-api.com
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
43	ip-api.com

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Xworm V5.6.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Xworm V5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Xworm V5.6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Xworm V5.6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 44 IoCs

Processes:

Xworm V5.6.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Xworm V5.6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Xworm V5.6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Xworm V5.6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Xworm V5.6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Xworm V5.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	Xworm V5.6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Xworm V5.6.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Xworm V5.6.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Xworm V5.6.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

Processes:

Xworm V5.6.exemsedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
692	msedge.exe
692	msedge.exe
5680	msedge.exe
5680	msedge.exe
4708	msedge.exe
4708	msedge.exe
3132	identity_helper.exe
3132	identity_helper.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

7zFM.exeXworm V5.6.exe

pid process

6076 7zFM.exe
1908 Xworm V5.6.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

Processes:

msedge.exe

pid	process
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

7zFM.exeAUDIODG.EXEXClient.exe

description	pid	process
Token: SeRestorePrivilege	6076	7zFM.exe
Token: 35	6076	7zFM.exe
Token: SeSecurityPrivilege	6076	7zFM.exe
Token: 33	4164	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4164	AUDIODG.EXE
Token: SeDebugPrivilege	1184	XClient.exe

Suspicious use of FindShellTrayWindow 31 IoCs

Processes:

7zFM.exeXworm V5.6.exemsedge.exe

pid	process
6076	7zFM.exe
6076	7zFM.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe

Suspicious use of SendNotifyMessage 15 IoCs

Processes:

Xworm V5.6.exemsedge.exe

pid	process
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
1908	Xworm V5.6.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe
5680	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Xworm V5.6.exe

pid process

1908 Xworm V5.6.exe
1908 Xworm V5.6.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Xworm V5.6.exemsedge.exe

description	pid	process	target process
PID 1908 wrote to memory of 5680	1908	Xworm V5.6.exe	msedge.exe
PID 1908 wrote to memory of 5680	1908	Xworm V5.6.exe	msedge.exe
PID 5680 wrote to memory of 4312	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 4312	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 5992	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 692	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 692	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 6096	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 6096	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 6096	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 6096	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 6096	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 6096	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 6096	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 6096	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 6096	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 6096	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 6096	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 6096	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 6096	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 6096	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 6096	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 6096	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 6096	5680	msedge.exe	msedge.exe
PID 5680 wrote to memory of 6096	5680	msedge.exe	msedge.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm-5.6-main.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5632

C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\Xworm V5.6.exe
"C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\Xworm V5.6.exe"
1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://evilcoder.mysellix.io/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffc682f3cb8,0x7ffc682f3cc8,0x7ffc682f3cd8
    3⤵
    PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,8771561636370458637,1519698336926779546,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2044 /prefetch:2
    3⤵
    PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,8771561636370458637,1519698336926779546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,8771561636370458637,1519698336926779546,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8771561636370458637,1519698336926779546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8771561636370458637,1519698336926779546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8771561636370458637,1519698336926779546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
    3⤵
    PID:2248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8771561636370458637,1519698336926779546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2036,8771561636370458637,1519698336926779546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8771561636370458637,1519698336926779546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8771561636370458637,1519698336926779546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
    3⤵
    PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8771561636370458637,1519698336926779546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8771561636370458637,1519698336926779546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
    3⤵
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,8771561636370458637,1519698336926779546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8771561636370458637,1519698336926779546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8771561636370458637,1519698336926779546,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
    3⤵
    PID:5340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8771561636370458637,1519698336926779546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
    3⤵
    PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8771561636370458637,1519698336926779546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8771561636370458637,1519698336926779546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6460 /prefetch:1
    3⤵
    PID:252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,8771561636370458637,1519698336926779546,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
    3⤵
    PID:1844
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\315hsdo3\315hsdo3.cmdline"
  2⤵
  PID:1212
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES297D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc521DC8CEF9EF4F278AE621273A88778C.TMP"
    3⤵
    PID:5856

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2252

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x000000000000049C
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2468

C:\Users\Admin\Downloads\XClient.exe
"C:\Users\Admin\Downloads\XClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
215KB

MD5
0e3d96124ecfd1e2818dfd4d5f21352a

SHA1
098b1aa4b26d3c77d24dc2ffd335d2f3a7aeb5d7

SHA256
eef545efdb498b725fbabeedd5b80cec3c60357df9bc2943cfd7c8d5ae061dcc

SHA512
c02d65d901e26d0ed28600fa739f1aa42184e00b4e9919f1e4e9623fe9d07a2e2c35b0215d4f101afc1e32fc101a200ca4244eb1d9ca846065d387144451331c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
949069830b9e64f2c5ae2ae02044f000

SHA1
9e8f84bc6921108aeca49509c4780bcc2487b1c2

SHA256
aa107a5244db086525315bb3acff0c0097209d5150072ba10d51e83db08b0c99

SHA512
7e4c0377802cfa08ee2fdf7bdc5e3d98aa31a1167d390d3b8bdac7b7c1985421ad4e2a83e8328769bd1c718529ff65261bf31e5bcc94128ca95b856ccdba068f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2bb625af1f9b4b8f58ceac4cf75d9907

SHA1
cd6afd5374aca5bc19fdd579e6b93570ed4d45ef

SHA256
3b5a2ca8a19ccf2d32b31d0939d8dc7c783aab14ab0426a2ddcbc790a256cda1

SHA512
d9719bf9fb7589a36e8c4bf74456f3804e85f82537336c758df0fa16796b4e192488d0a0a588bef9892df64440227cf12d1e1811ea3b60d69a9c512acbe80c2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
779396fee67f345e967f999bba006544

SHA1
2dfe3ed87b3d099301302627e0fe203ace406480

SHA256
a83400a1efd25bd78d36680a8a75f92a165d963a79bd10831f04c77d6f57c5c7

SHA512
4203b59afb2bb30a51d4d0f3220c1e2b74e3dd0342d2bbbb35ad8c3fcfeec79936e11651922bee9fdc8c2e832289cd771c7cb2af3d4e9d3f406c8f953a73a794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
578a139e7e36e3ef7f4b81d7050d56ac

SHA1
a218ee0e82cefd9d151eba9f3bf0532cc6a60bbd

SHA256
2bc585b3b3fbcf9f8db6b036d49469dc995f0240c9ba0612274eaf343cc57ee5

SHA512
23dad2cf280e039d4d6cc6ca8769dacb51d851cf1b10d9e77afa826fb158eba59b542567199c66d4ff6cf22bfae778c8a12c5bf36a6bff90dbe71792a8d4c0b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cc2040aaa4ec49c2ffdc1e9e484634c9

SHA1
f91ae86266ca61c4ccef51b244b4c676b21eab6b

SHA256
1f6d91c3d3a449a57c35cb8a68f2092761fb15e8b6b54cc0c9cba2173cd7efbc

SHA512
3f3d1bcf01212b2338b80309232018d594de1df14b9750998e365b5b98bf274dd4a9962aa92c067be4e26d71a1dfee419435cf84cd158ca5dbc80c28e644a7f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
46c7f55180b348557dcf328e1e46baf3

SHA1
b1c75b43f5c59ddbb168fecde20898b195857ff5

SHA256
28e70cbb3e992e2c6346052d98c571e58482dcaf638825392f5a58bc77b2a657

SHA512
2868f7bc12ab01c23c33bc9984387b1113e45f4ca0da15745a780196c835d3d195e089639d6b61f60cd904587d4259af56df154dca4b3803df4858a85cdaa4c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe593d6d.TMP

Filesize
1KB

MD5
b819ebceb49978b06936d102492d8fe1

SHA1
5477e01f766746b24fa024bffbbd5cd21f85acde

SHA256
3f7eefbe50d2628c4234f31072be62a3ba37e54955725d12d9113dce04b523b9

SHA512
441400639f1476df2ddfec3336956a081cd2d3e1fef6e8ca7f33a77d287ceb30469fa801f803ffc77038f2b5ec1ca550e680c0b91ae3bee1b4e1ce75d830a2c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f1d3127c93b2f5598e49a3bf970b56a0

SHA1
c9a55d5d526cbdb0765ee61140ca35fee34413ac

SHA256
785fb068ca28e2a6986f920ed4bb1b9771fb61ef6f57ace729cdbf46ec0e4b1c

SHA512
ce8e3f2f6c186429689ab02260efbed392c98cf575f23644a2666750aa701486c52a710db2d39c66137e3a06ca1e250b01d2099ab39c69e76be793b340c49850

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
22e8febdc2c4e80ccb0d4e7d701781f4

SHA1
0a78350c1ed2f0f9778be33012ffe31d10373b07

SHA256
c91fb4b5cfc57190e2ce0b2669d9aeb3d67f1c2edcedaa295f6ab61aea5144bb

SHA512
8d12984129b62ea9c4a0964d361fb88acc876f03fb5f43366ae0482cb8e616208eefcd202e32b9fa31bc53cfc0b70d0434ecc70e22c799cd4a3f5088e1deb961

Download Submit
C:\Users\Admin\AppData\Local\Temp\315hsdo3\315hsdo3.0.vb

Filesize
78KB

MD5
c7fce9eaa85ab524fdbfe6bd4c3ebba7

SHA1
7fccdb82f510642ec7db92d6de870dcbccfdfc91

SHA256
f1b50f248397dada1d6ecc02e5433f29c6e8d7e315fb798284fe6beea42f259e

SHA512
aece6ab668c01d06a37f1a6a49d9a94e1871644f8620db6309133237181d4f8a25404ffaab941af24c92901c7ca620508893e050f230a7fe5ce9091f5aec0fd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\315hsdo3\315hsdo3.cmdline

Filesize
292B

MD5
1a224848e6a12a3020eedafc27fc625a

SHA1
3b26c13a6381db9c55c5b2e9d62fde3a6c56293e

SHA256
eb19b19bf5d19e85fa55b17cc506747f9bc2274d26db0cda5bbd0fced27484b6

SHA512
4a62f17b47bb81ae4a621e527b3d7a483e0edbe26c2515dd7018cc872015a970885cfacca2984c0b8636590ea8afbf4bbdb10c45b9442b0663fc08d602acab79

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES297D.tmp

Filesize
1KB

MD5
6ed3cad5b663f760c018b56c1ee4e37d

SHA1
b0954dc6e4c2631a79dc2cbbc64bfc7cd8e39b4b

SHA256
daac9f04b8fbcf235dc1077aa3975f7bacd399450ab3e820a38bbc8213ada787

SHA512
8490c5ce9369cb75ac7db41955f5b3a0a36067e400a47371b40a1b9469da373a7b029522cadcdb82e3e078a498b08b1aa206caf24740fbb98eb7a16f77f5de62

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc521DC8CEF9EF4F278AE621273A88778C.TMP

Filesize
1KB

MD5
d40c58bd46211e4ffcbfbdfac7c2bb69

SHA1
c5cf88224acc284a4e81bd612369f0e39f3ac604

SHA256
01902f1903d080c6632ae2209136e8e713e9fd408db4621ae21246b65bfea2ca

SHA512
48b14748e86b7d92a3ea18f29caf1d7b4b2e1de75377012378d146575048a2531d2e5aaeae1abf2d322d06146177cdbf0c2940ac023efae007b9f235f18e2c68

Download Submit
C:\Users\Admin\Downloads\XClient.exe

Filesize
45KB

MD5
9ee75227d1191640079a09a90e3842de

SHA1
cbbfdabab306a170c41da5234b5fda6870c2345b

SHA256
e2a7450750911dfd8ec758c69be138742dc970836649bc556b020509c88da055

SHA512
3ec6ae992e41667667abfd2130ad03b7d426dca7cf149dc6a6f88267478c3837079202e268330ffc4bd8064f014fd778be6d5c1da7128940056fc4fb7e2df259

Download Submit
C:\Users\Admin\Downloads\XClient.exe

Filesize
83KB

MD5
d481b0eed45516fef47ae1336f34c9e7

SHA1
398efe657a8b06cc4742bf5372f9c94a2339a9ef

SHA256
ecc744a07ed1ab914b922c3053f2e7b16f594620e4be6243f8c7b71e3cf0f69d

SHA512
1f2e68ea9efd25e98259b1963d7381a506970bf4f9db2af17e9e2b59b7a7bc44731d710f509697af8011a54ae61b1f81494478114d5193fbee5a10984bdf6486

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\GeoIP.dat

Filesize
1.2MB

MD5
8ef41798df108ce9bd41382c9721b1c9

SHA1
1e6227635a12039f4d380531b032bf773f0e6de0

SHA256
bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740

SHA512
4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\Guna.UI2.dll

Filesize
1.9MB

MD5
bcc0fe2b28edd2da651388f84599059b

SHA1
44d7756708aafa08730ca9dbdc01091790940a4f

SHA256
c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef

SHA512
3bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\Icons\icon (15).ico

Filesize
361KB

MD5
e3143e8c70427a56dac73a808cba0c79

SHA1
63556c7ad9e778d5bd9092f834b5cc751e419d16

SHA256
b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

SHA512
74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\SimpleObfuscator.dll

Filesize
1.4MB

MD5
9043d712208178c33ba8e942834ce457

SHA1
e0fa5c730bf127a33348f5d2a5673260ae3719d1

SHA256
b7a6eea19188b987dad97b32d774107e9a1beb4f461a654a00197d73f7fad54c

SHA512
dd6fa02ab70c58cde75fd4d4714e0ed0df5d3b18f737c68c93dba40c30376cc93957f8eef69fea86041489546ce4239b35a3b5d639472fd54b80f2f7260c8f65

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\Sounds\Intro.wav

Filesize
238KB

MD5
ad3b4fae17bcabc254df49f5e76b87a6

SHA1
1683ff029eebaffdc7a4827827da7bb361c8747e

SHA256
e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf

SHA512
3d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\Xworm V5.6.exe

Filesize
14.9MB

MD5
56ccb739926a725e78a7acf9af52c4bb

SHA1
5b01b90137871c3c8f0d04f510c4d56b23932cbc

SHA256
90f58865f265722ab007abb25074b3fc4916e927402552c6be17ef9afac96405

SHA512
2fee662bc4a1a36ce7328b23f991fa4a383b628839e403d6eb6a9533084b17699a6c939509867a86e803aafef2f9def98fa9305b576dad754aa7f599920c19a1

Download Submit
C:\Users\Admin\Downloads\XWorm-5.6-main\XWorm-5.6-main\Xworm V5.6.exe.config

Filesize
183B

MD5
66f09a3993dcae94acfe39d45b553f58

SHA1
9d09f8e22d464f7021d7f713269b8169aed98682

SHA256
7ea08548c23bd7fd7c75ca720ac5a0e8ca94cb51d06cd45ebf5f412e4bbdd7d7

SHA512
c8ea53ab187a720080bd8d879704e035f7e632afe1ee93e7637fad6bb7e40d33a5fe7e5c3d69134209487d225e72d8d944a43a28dc32922e946023e89abc93ed

Download Submit
\??\pipe\LOCAL\crashpad_5680_PJLLKCIORUYTJYVN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1184-747-0x0000000000780000-0x000000000079C000-memory.dmp

Filesize
112KB

Download
memory/1908-723-0x000001DA7C390000-0x000001DA7C4F8000-memory.dmp

Filesize
1.4MB

Download
memory/1908-247-0x00007FFC56A90000-0x00007FFC57552000-memory.dmp

Filesize
10.8MB

Download
memory/1908-255-0x000001DA6FDE0000-0x000001DA6FDE9000-memory.dmp

Filesize
36KB

Download
memory/1908-245-0x00007FFC56A93000-0x00007FFC56A95000-memory.dmp

Filesize
8KB

Download
memory/1908-257-0x000001DA706F0000-0x000001DA7070E000-memory.dmp

Filesize
120KB

Download
memory/1908-258-0x000001DA713A0000-0x000001DA713AB000-memory.dmp

Filesize
44KB

Download
memory/1908-254-0x000001DA704B0000-0x000001DA704F6000-memory.dmp

Filesize
280KB

Download
memory/1908-256-0x000001DA70500000-0x000001DA7050D000-memory.dmp

Filesize
52KB

Download
memory/1908-251-0x00007FFC56A90000-0x00007FFC57552000-memory.dmp

Filesize
10.8MB

Download
memory/1908-250-0x00007FFC56A93000-0x00007FFC56A95000-memory.dmp

Filesize
8KB

Download
memory/1908-249-0x000001DA71890000-0x000001DA71A84000-memory.dmp

Filesize
2.0MB

Download
memory/1908-246-0x000001DA545B0000-0x000001DA55498000-memory.dmp

Filesize
14.9MB

Download